High severity7.5NVD Advisory· Published Jul 1, 2026· Updated Jul 24, 2026
CVE-2026-54399
CVE-2026-54399
Description
Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length
Affected products
63<5.5-beta1+ 4 more
- (no CPE)range: <5.5-beta1
- cpe:2.3:a:apache:httpcomponents_core:*:*:*:*:*:*:*:*range: >=5.0,<=5.4.2
- cpe:2.3:a:apache:httpcomponents_core:5.5:alpha1:*:*:*:*:*:*
- cpe:2.3:a:apache:httpcomponents_core:5.5:beta1:*:*:*:*:*:*
- (no CPE)range: <=5.4.2, <=5.5-beta1
- osv-coords58 versionspkg:apk/chainguard/airbyte-platform-bootloaderpkg:apk/chainguard/airbyte-platform-cronpkg:apk/chainguard/airbyte-platform-fips-bootloaderpkg:apk/chainguard/airbyte-platform-fips-cronpkg:apk/chainguard/airbyte-platform-fips-serverpkg:apk/chainguard/airbyte-platform-fips-workerspkg:apk/chainguard/airbyte-platform-fips-workload-api-serverpkg:apk/chainguard/airbyte-platform-fips-workload-launcherpkg:apk/chainguard/airbyte-platform-serverpkg:apk/chainguard/airbyte-platform-workerspkg:apk/chainguard/airbyte-platform-workload-api-serverpkg:apk/chainguard/airbyte-platform-workload-launcherpkg:apk/chainguard/airbyte-serverpkg:apk/chainguard/airbyte-server-fipspkg:apk/chainguard/akhqpkg:apk/chainguard/apache-nifi-2.11pkg:apk/chainguard/apicurio-registrypkg:apk/chainguard/apicurio-registry-fipspkg:apk/chainguard/camunda-zeebe-8.6pkg:apk/chainguard/cassandra-reaperpkg:apk/chainguard/dependency-track-apiserver-4pkg:apk/chainguard/druidpkg:apk/chainguard/elasticsearch-9.2pkg:apk/chainguard/elasticsearch-9.2-iamguardedpkg:apk/chainguard/elasticsearch-9.2-iamguarded-fipspkg:apk/chainguard/elasticsearch-9.3pkg:apk/chainguard/elasticsearch-9.3-iamguardedpkg:apk/chainguard/elasticsearch-9.3-iamguarded-fipspkg:apk/chainguard/elasticsearch-9.4pkg:apk/chainguard/elasticsearch-9.4-iamguardedpkg:apk/chainguard/elasticsearch-9.4-iamguarded-fipspkg:apk/chainguard/elasticsearch-fips-9.2pkg:apk/chainguard/elasticsearch-fips-9.3pkg:apk/chainguard/elasticsearch-fips-9.4pkg:apk/chainguard/flocipkg:apk/chainguard/floci-azpkg:apk/chainguard/geoserver-3.0pkg:apk/chainguard/jbangpkg:apk/chainguard/kayenta-2026.0pkg:apk/chainguard/kayenta-2026.1pkg:apk/chainguard/kayenta-fips-2026.0pkg:apk/chainguard/kayenta-fips-2026.1pkg:apk/chainguard/nrjmxpkg:apk/chainguard/nuxeo-2023pkg:apk/chainguard/pinotpkg:apk/chainguard/pinot-fipspkg:apk/chainguard/reposilitepkg:apk/chainguard/thingsboard-tb-mqtt-transportpkg:apk/chainguard/thingsboard-tb-nodepkg:apk/chainguard/traccarpkg:apk/chainguard/traccar-fipspkg:apk/wolfi/akhqpkg:apk/wolfi/apicurio-registrypkg:apk/wolfi/cassandra-reaperpkg:apk/wolfi/druidpkg:apk/wolfi/nrjmxpkg:apk/wolfi/thingsboard-tb-mqtt-transportpkg:apk/wolfi/thingsboard-tb-node
< 2.0.0-r1+ 57 more
- (no CPE)range: < 2.0.0-r1
- (no CPE)range: < 2.0.0-r1
- (no CPE)range: < 2.0.0-r1
- (no CPE)range: < 2.0.0-r1
- (no CPE)range: < 2.0.0-r1
- (no CPE)range: < 2.0.0-r1
- (no CPE)range: < 2.0.0-r1
- (no CPE)range: < 2.0.0-r1
- (no CPE)range: < 2.0.0-r1
- (no CPE)range: < 2.0.0-r1
- (no CPE)range: < 2.0.0-r1
- (no CPE)range: < 2.0.0-r1
- (no CPE)range: < 2.0.0-r10
- (no CPE)range: < 2.0.0-r12
- (no CPE)range: < 0.28.0-r3
- (no CPE)range: < 2.11.0-r2
- (no CPE)range: < 3.3.1-r4
- (no CPE)range: < 3.3.1-r4
- (no CPE)range: < 8.6.39-r8
- (no CPE)range: < 5.0.0-r6
- (no CPE)range: < 4.14.3-r3
- (no CPE)range: < 37.0.0-r49
- (no CPE)range: < 9.2.8-r10
- (no CPE)range: < 9.2.8-r10
- (no CPE)range: < 9.2.8-r9
- (no CPE)range: < 9.3.8-r2
- (no CPE)range: < 9.3.8-r2
- (no CPE)range: < 9.3.7-r6
- (no CPE)range: < 9.4.4-r4
- (no CPE)range: < 9.4.4-r4
- (no CPE)range: < 9.4.5-r0
- (no CPE)range: < 9.2.8-r9
- (no CPE)range: < 9.3.7-r6
- (no CPE)range: < 9.4.5-r0
- (no CPE)range: < 1.6.0-r1
- (no CPE)range: < 0.10.0-r1
- (no CPE)range: < 3.0.0-r7
- (no CPE)range: < 0.141.0-r2
- (no CPE)range: < 2026.0.7-r1
- (no CPE)range: < 2026.1.2-r3
- (no CPE)range: < 2026.0.5-r1
- (no CPE)range: < 2026.1.2-r3
- (no CPE)range: < 2.13.0-r1
- (no CPE)range: < 2023.45-r6
- (no CPE)range: < 1.5.1-r13
- (no CPE)range: < 1.5.1-r9
- (no CPE)range: < 3.6.2-r0
- (no CPE)range: < 4.3.1.3-r17
- (no CPE)range: < 4.3.1.3-r17
- (no CPE)range: < 6.14.5-r3
- (no CPE)range: < 6.14.5-r5
- (no CPE)range: < 0.28.0-r3
- (no CPE)range: < 3.3.1-r4
- (no CPE)range: < 5.0.0-r6
- (no CPE)range: < 37.0.0-r49
- (no CPE)range: < 2.13.0-r1
- (no CPE)range: < 4.3.1.3-r17
- (no CPE)range: < 4.3.1.3-r17
Patches
Vulnerability mechanics
References
6- www.openwall.com/lists/oss-security/2026/07/01/4nvdMailing ListThird Party Advisory
- github.com/advisories/GHSA-hf6x-8p5f-cgmfghsaADVISORY
- lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpynvdMailing ListVendor Advisory
- github.com/apache/httpcomponents-core/commit/d96a00fec9b2e19f8005e35681df5f6cd6e21a9eghsa
- github.com/apache/httpcomponents-core/commit/fdc53a32fe0fccf098cc67e71cd125e447c759edghsa
- nvd.nist.gov/vuln/detail/CVE-2026-54399ghsa
News mentions
1- Apache Software Foundation: 21 Vulnerabilities Across Multiple Products Disclosed in Early July 2026Vypr Intelligence · Jul 3, 2026